In contrast, some recent work proposes to use clean samples only to compute the probability of whether an input instance falls in the legitimate input distribution [1]}, [2]}, [3]}, [4]}, [5]}. Among them, PixelDefend [4]} computes the probability with a generative model. Zheng et.al model the output distribution of the hidden neurons in a DNN classifier with a Gaussian Mixture Model [1]}. Ma et. al. propose to use the one-class SVM to extract the model in-variants (e.g. distribution of the neuron activation values) for anomaly detection [2]}. Generally speaking, the above techniques are more effective for AEs with large perturbations as they are more easily to be identified as outliers.
<FIGURE>